v3.0.3

Fix proposal base selection for PR pushes and draft patches, refresh dependencies,
and clarify agent guidance for repository data refreshes.

Changed

• Refresh Rust dependencies and the lockfile, including Nostr SDK 0.45.4,
  Reqwest 0.13.5, Rustls 0.23.45, apk-info 1.0.13, mailparse 0.17.0,
  keyring 4.2.0, and the test harness dependencies. Relevant upstream fixes:
  • Rustls rejects TLS 1.3 handshake messages received at the wrong encryption
    level (GHSA-2mjx-qc3c-rqvc).
  • Reqwest selects the correct credentials when multiple proxies match a URL
    and recognizes timeouts wrapped in response-body decoding errors
    (release notes).
  • APK analysis can continue when the resource table is corrupt, resolves
    sparse resource entries correctly, and reads ZIP entries lazily to reduce
    memory use with large archives
    (release notes).
  • The Nostr SDK's local relay, used by the test harness, closes subscriptions
    when their live-event buffer overflows so clients can detect missing events
    (crate changelog).
• Clarify the agent skill's shared repository-data refresh behavior across git
  and ngit commands, and when to reuse cached data with --offline to avoid
  redundant relay fetching.

Fixed

• Fix PR pushes when changes are already on your local default branch or
  another remote but have not been accepted by the Nostr destination.
  A PR that points to the same commit as local main or master works too.
• Support maintainers who build PRs on a newer local default branch. For a new
  PR sharing local commits that have not been published to Nostr, explain how
  -o base=<commit-or-ref> chooses where the proposed changes start. Earlier
  commits remain in Git history. Local changes outside the PR need no confirmation.
• Keep ngit send working for drafts made directly on main or master.
  Rejection messages explain how --base <commit-or-ref> lets you choose
  which earlier commits to exclude. Remote names such as origin or github
  do not establish ownership or accepted history.